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Introduction 


The Information Commissioner (the Commissioner) is calling for evidence 
and views on the Age Appropriate Design Code (the Code). 


The Code is a requirement of the Data Protection Act 2018 (the Act). The 
Act supports and supplements the implementation of the EU General Data 
Protection Regulation (the GDPR). 


The Code will provide guidance on the design standards that the 
Commissioner will expect providers of online ‘Information Society 
Services’ (ISS), which process personal data and are likely to be accessed 
by children, to meet. Once it has been published, the Commissioner will 
be required to take account of any provisions of the Code she considers to 
be relevant when exercising her regulatory functions. The courts and 
tribunals will also be required to take account of any provisions they 
consider to be relevant in proceedings brought before them. The Code 
may be submitted as evidence in court proceedings. 


Further guidance on how the GDPR applies to children’s personal data can 
be found in our guidance Children and the GDPR. It will be useful to read 
this before responding to the call for evidence, to understand what is 
already required by the GDPR and what the ICO currently recommends as 
best practice. In drafting the Code the ICO may consider suggestions that 
reinforce the specific requirements of the GDPR, or its overarching 
requirement that children merit special protection, but will disregard any 
suggestions that fall below this standard. 


The Commissioner will be responsible for drafting the Code. The Act 
provides that the Commissioner must consult with relevant stakeholders 
when preparing the Code, and submit it to the Secretary of State for 
Parliamentary approval within 18 months of 25 May 2018. She will publish 
the Code once it has been approved by Parliament. 


This call for evidence is the first stage of the consultation process. The 
Commissioner seeks evidence and views on the development stages of 
childhood and age-appropriate design standards for ISS. The 
Commissioner is particularly interested in evidence based submissions 
provided by: bodies representing the views of children or parents; child 
development experts; providers of online services likely to be accessed by 
children, and trade associations representing such providers. She 
appreciates that different stakeholders will have different and particular 
areas of expertise. The Commissioner welcomes responses that are 
limited to specific areas of interest or expertise and only address 
questions within these areas, as well as those that address every question 
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asked. She is not seeking submissions from individual children or parents 
in this call for evidence as she intends to engage with these stakeholder 
groups via other dedicated and specifically tailored means. 


The Commissioner will use the evidence gathered to inform further work 
in developing the content of the Code. 


The scope of the Code 


The Act affords the Commissioner discretion to set such standards of age 
appropriate design as she considers to be desirable, having 

regard to the best interests of children, and to provide such guidance as 
she considers appropriate. 


In exercising this discretion the Act requires the Commissioner to have 
regard to the fact that children have different needs at different ages, and 
to the United Kingdom’s obligations under the United Nations Convention 
on the Rights of the Child. 


During Parliamentary debate the Government committed to supporting 
the Commissioner in her development of the Code by providing her with a 
list of ‘minimum standards to be taken into account when designing it.’ 
The Commissioner will have regard to this list both in this call for 
evidence, and when exercising her discretion to develop such standards 
as she considers to be desirable 


In developing the Code the Commissioner will also take into account that 
the scope and purpose of the Act, and her role in this respect, is limited to 
making provision for the processing of personal data. 


Responses to this call for evidence must be submitted by 19 September 
2018. You can submit your response in one of the following ways: 


Online 


Download this document and email to: 


childrenandtheGDPR@ICO.org.uk 


Print off this document and post to: 

Age Appropriate Design Code call for evidence 
Engagement Department 

Information Commissioner’s Office 

Wycliffe House 

Water Lane 

Wilmslow 


V1.0 20180626 


Cheshire SK9 5AF 


If you would like further information on the call for evidence please 
telephone 0303 123 1113 and ask to speak to the Engagement 
Department about the Age Appropriate Design Code or email 


childrenandtheGDPR@ICO.org.uk 


Privacy statement 

For this call for evidence we will publish responses received from 
organisations but will remove any personal data before publication. We 
will not publish responses from individuals. For more information about 
what we do with personal data please see our privacy notice. 
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Section 1: Your views and evidence 


Please provide us with your views and evidence in the following areas: 


Development needs of children at different ages 


The Act requires the Commissioner to take account of the development 
needs of children at different ages when drafting the Code. 


The Commissioner proposes to use their age ranges set out in the report 
Digital Childhood - addressing childhood development milestones in the 
Digital Environment as a starting point in this respect. This report draws 
upon a number of sources including findings of the United Kingdom 
Council for Child Internet Safety (UKCCIS) Evidence Group in its literature 


review of Children’s online activities risks and safety. 


The proposed age ranges are as follows: 


3°) 
6-9 
10-12 
13-15 
16-17 


Qi. In terms of setting design standards for the processing of children’s 
personal data by providers of ISS (online services), how appropriate you 
consider the above age brackets would be (delete as appropriate): 


Not at all appropriate 
Not really appropriate 
Quite appropriate 
Very appropriate 


Q1A. Please provide any views or evidence on how appropriate you 
consider the above age brackets would be in setting design standards for 
the processing of children’s personal data by providers of ISS (online 
services), 


Q2. Please provide any views or evidence you have on children’s 
development needs, in an online context in each or any of the above age 
brackets. 
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The United Nations Convention on the Rights of the Child 


The Data Protection Act 2018 requires the Commissioner to take account 
of the UK’s obligations under the UN Convention on the Rights of the Child 
when drafting the Code. 


Q3. Please provide any views or evidence you have on how the 
Convention might apply in the context of setting design standards for the 
processing of children’s personal data by providers of ISS (online 
services) 


Aspects of design 


The Government has provided the Commissioner with a list of areas which 
it proposes she should take into account when drafting the Code. 


These are as follows: 

e default privacy settings, 

e data minimisation standards, 

e the presentation and language of terms and conditions and privacy 
notices, 

e uses of geolocation technology, 

e automated and semi-automated profiling, 

e transparency of paid-for activity such as product placement and 
marketing, 

e the sharing and resale of data, 

e the strategies used to encourage extended user engagement, 

e user reporting and resolution processes and systems, 

e the ability to understand and activate a child’s right to erasure, 
rectification and restriction, 

e the ability to access advice from independent, specialist advocates 
on all data rights, and 

e any other aspect of design that the commissioner considers 
relevant. 


Q4. Please provide any views or evidence you think the Commissioner 
Should take into account when explaining the meaning and coverage of 
these terms in the code. 


Q5. Please provide any views or evidence you have on the following: 
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Q5A. about the opportunities and challenges you think might arise in 
setting design standards for the processing of children’s personal data by 
providers of ISS (online services), in each or any of the above areas. 


Q5B. about how the ICO, working with relevant stakeholders, might use 
the opportunities presented and positively address any challenges you 
have identified. 


Q5C. about what design standards might be appropriate (ie where the bar 
Should be set) in each or any of the above areas and for each or any of 
the proposed age brackets. 


We would support the imposition of design standards for “presentation and 
language of terms and conditions and privacy notices.” We would argue 
that design standards for the “presentation and language of terms and 
conditions and privacy notices” should not be solely based on a reading age 
calculated in accordance with a particular reading age calculator. Similar, 
information about rights and advice from specialist advocates should be 
presented in language that can be understood by readers. We would argue 
that where a service has users in more than one age bracket consideration 
Should be given to drafting information differently for readers in each age 
bracket, and that information should be drafted in order to be 
understandable to foreseeable readers, not simply intended readers. 
Therefore, if it is foreseeable that a child of 13 will use an ISS, the 
presentation and language should be tailored to that foreseeable user. 


Our research, which was conducted with adults,* demonstrates that reading 
scores should not be the only mechanisms used for determining whether a 
document can be understood by a reader. This is because (a) it is possible 
to manipulate a document to reach a particular reading score, especially if 
the required score is based on a single reading score metric produced by a 
single calculator; (b) reading scores are (generally) document level 
metrics, and therefore a reading score which shows that a document 
complies overall with a regulatory requirement may mask parts of a 
document that cannot be understood; and (c) reading scores do not 
measure how readers interact with particular parts of documents, and do 
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not show how they understand the information presented, even if the 
reading score complies with a particular requirement. 


We suggest that the Commissioner use more sophisticated techniques to 
understand the interaction between children and terms and conditions and 
privacy notices. In particular, we would suggest that (in regulatory 
enforcement action) the Commissioner consider using eye-tracking to 
assess the ways that children in particular age brackets understand terms 
and conditions and privacy notices. This technique? allows examination of 
consumers reading behaviour, and identification of word-level processing 
bottlenecks that may impede readers’ ability to understand documentation. 
In eye-tracking research conducted with adults, we have identified drafting 
practices which make comprehension more difficult whilst not necessarily 
increasing reading scores, such as separating definitions from the clauses 
in which they are used, using provisos to modify the apparent meaning of 
a clause, and using unexpected word combinations. 


As well as age, interacting vulnerabilities should also be considered, and 
where a foreseeable user is likely to have reduced comprehension ability 
due to circumstances other than age then the information provided should 
be provided in a form accessible and tailored to them. For example, 
consideration should be given to aural methods for transmitting 
information, or the use of “comic contracts.”? 


Q5D. examples of ISS design you consider to be good practice. 


Q5E. about any additional areas, not included in the list above that you 
think should be the subject of a design standard. 


Q6. If you would be interested in contributing to future solutions focussed 
work in developing the content of the code please provide the following 
information. The Commissioner is particularly interested in hearing from 
bodies representing the views of children or parents, child development 
experts and trade associations representing providers of online services 
likely to be accessed by children, in this respect. 


understandable- 90313; https://www.forbes.com/sites/katevitasek/2017/02/14/comic- 


contracts-a-novel-approach-to-contract-clarity-and-accessibility/ # 76df6448 7635. 
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i: 


Brief summary of what you think you could offer: 


Testing of terms and conditions and privacy notices (and alternatives such 
as comic and aural contracts) to explore how readers understand them. We 
are currently developing a research project to do this and would be 
interested to engage with the Commissioner in this regard. 


Further views and evidence 


Q7. Please provide any other views or evidence you have that you 
consider to be relevant to this call for evidence. 


Consideration should be given to the interaction between the age 
appropriate design code and consumer law. Particularly where terms and 
conditions are not transparent, consideration should be given to their 
compliance with the Consumer Rights Act 2015, especially where the site 
is a paid-for subscription service. Further, the role of the Consumer 
Protection from Unfair Trading Regulations 2008 should be considered, and 
particularly whether regulation 5(3)(b), which makes it an unfair 
commercial practice to fail to comply with a commitment in a code of 
conduct, applies to the age appropriate design code or whether a failure to 
abide by the age appropriate design code amounts to a commercial practice 
that “contravenes the requirements of professional diligence” contrary to 
regulation 3 of the 2008 Regulations. 
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Section 2: About you 


Are you: 


A body representing the views or interests of children? 
Please specify: 


A body representing the views or interests of parents? 
Please specify: 


A child development expert? 
Please specify: 


A provider of ISS likely to be accessed by children? 
Please specify: 


A trade association representing ISS providers? 
Please specify: 


An ICO employee? 
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Other? 


Please specify: 
Academics 


Thank you for responding to this call for evidence. 
We value your input. 
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